* SECURITY UPDATE: DoS via NULL pointer dereference when SMTP refuses to
send certain warning messages
* added 05_CVE-2007-4565.dpatch to sink.c to verify msg is not NULL
* SECURITY UPDATE: Due to a design flaw in the APOP protocol, remote
attackers may be able to acquire a portion of a user's authentication
credentials using man-in-the-middle techniques.
* added 06_CVE-2007-1558.dpatch. This patch adds notes about APOP's
limitations as well as updating pop3.c to more strictly validate the
presented challenge for RFC-822 conformity. This change to pop3.c does
not fix the APOP design flaw, but does make attacks against APOP somewhat
more difficult.
* References
CVE-2007-4565
CVE-2007-1558